feat(config): read the HTTP port from .wflcfg

[logbie]

Summary

Scriptorium always listened on port 8080 even when a different port was needed. It now reads web_server_port from the local .wflcfg; for example, web_server_port = 9090 binds port 9090 after restart. A missing setting or config file keeps the default 8080.

Changes

• Add the documented web_server_port = 8080 setting and validate whole-number ports from 1 through 65535; empty, malformed, fractional, and out-of-range values fall back to 8080.
• Use the resolved port for the listener and both startup URLs.
• Add five utility tests and three real HTTP tests using isolated temporary sites, and run the HTTP checks in the existing Blacksmith nightly Docker job.
• Update configuration, architecture, and testing documentation.

Compatibility and risk

• Risk class and reason: R2, HTTP listener configuration and integration coverage.
• Affected contracts: Optional application-parsed .wflcfg key and startup messages. Defaults, bind address, routes, stored data, and Scribe pin remain unchanged.
• Upgrade and recovery: Restart after changing the port; removing the setting restores 8080. No migration. Revert the commit to restore hardcoded behavior.
• Remaining risks or gaps: Port conflicts and OS permissions can still prevent binding a valid configured port. Local HTTP default tests require loopback 8080 to be free. Complete installer submission and other CMS journeys are outside this change.

Validation

• Tested revision and environment: abf568332d74727e8c1d52ed34c0495b85d1f23d; Windows with WFL 26.9.11 and pinned Scribe 93d62af5a6ed6c3ce257ef888107fc3ca1e2dc1d. Blacksmith Ubuntu 24.04 with WFL 26.9.12 and container Python 3.11.2 also passed. The nightly image resolved to bsbyrdwfl/wfl@sha256:7ddc51e6320affa7cfe26263fece590ddbdebe5582659b7e660ca823ed3ddbf1.
• Regression evidence: Before wiring the listener, the configured-port HTTP test requested 51651 and failed; captured process output proved the server still bound 8080. The missing-key and missing-file cases passed. After the change, all three cases passed in 1.678 seconds.
• Independent review: No actionable implementation, harness, or documentation findings.

Check or exact command	Result and evidence
python scripts/run_tests.py --include-scribe	Passed locally: 143 tests across 6 suites, including 25 utility tests and 83 upstream Scribe tests.
python -m unittest discover -s tests/integration -v	Passed locally: 3 tests asserting HTTP 200 installer responses and startup URLs for configured, absent-key, and absent-file cases.
python -m unittest discover -s tests/tooling -v	Passed locally: 36 tests.
python scripts/check_repo_hygiene.py	Passed locally: 84 candidate paths.
actionlint 1.7.12 and git diff --check	Passed; actionlint excludes only the official Blacksmith runner's unknown-label diagnostic.
Blacksmith nightly and Governance	WFL + HTTP checks passed: 143 WFL tests and 3 HTTP tests. Governance passed: 36 tooling tests and hygiene on Linux and Windows.
Security, migrations, and complete browser journeys	N/A — no auth, persistent schema, or UI behavior changes. HTTP bind and installer rendering are exercised with synthetic data.

Checklist

• The title, summary, and risk assessment match the final diff.
• Required validation is recorded above; failures and missing checks are explicit.
• Documentation, examples, and upgrade/recovery guidance are updated where applicable.
• I reviewed the diff for repository hygiene, secrets, and private site data.

[coderabbitai]

Warning

Review limit reached

Next included review available in 22 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8cb81fff-87c5-4b32-bd87-7e87769ee684

📥 Commits

Reviewing files that changed from the base of the PR and between 25d1568 and abf5683.

📒 Files selected for processing (10)

• .github/workflows/wfl-tests.yml
• .wflcfg
• CLAUDE.md
• README.md
• TestPrograms/util.test.wfl
• app/util.wfl
• docs/ARCHITECTURE.md
• main.wfl
• testing.md
• tests/integration/test_server_port.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.